Memory Consumption Vulnerability in OpenSSH Package Leading to Denial of Service
Summary
ALPINE-CVE-2025-26466: A flaw was found in the OpenSSH package. Affects openssh versions < 9.6_p1-r2. Fixed in 9.6_p1-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used implementation of the Secure Shell (SSH) protocol, providing secure remote login and other secure network services over an insecure network. It is known for its robust security features and is commonly utilized in various operating systems, including Alpine Linux. However, a recent vulnerability has been identified that affects multiple versions of OpenSSH in Alpine, which could lead to significant memory consumption and potential service unavailability.
Vulnerability Detail
A flaw was discovered in the OpenSSH package where, for each ping packet received by the SSH server, a pong packet is allocated in a memory buffer and stored in a queue. This pong packet is only freed after the server/client key exchange is completed. A malicious client can exploit this by continuously sending ping packets, resulting in uncontrolled memory consumption on the server side. This can lead to a denial of service (DoS) attack, making the server unavailable to legitimate users.
How To Fix
Minimum fixed version
9.6_p1-r2
This is the first release that contains the fix.
sudo apk add --upgrade opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to limit the number of ping packets that can be sent to the SSH server from a single client. This can be achieved by configuring firewall rules or using rate limiting on the server to mitigate the impact of potential DoS attacks.
Conclusion
The identified vulnerability in the OpenSSH package poses a significant risk of denial of service due to uncontrolled memory consumption. It is crucial for users to update their packages to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for openssh →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
The affected versions of OpenSSH in Alpine are those prior to 9.6_p1-r2 for v3.19, 9.7_p1-r5 for v3.20, and 9.9_p2-r0 for v3.21 and v3.22.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
The primary consequence is a denial of service (DoS) attack, where the server may become unavailable due to excessive memory consumption.
Yes, the permanent fix is to update the OpenSSH package to the specified patched versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
